Vape Shop Chargebacks: Fighting 'My Kid Used My Card' Disputes
Vape shop chargebacks from 'my kid used my card' claims can count twice under Visa's VAMP. See the evidence that wins and how to stop disputes early.
Photo: Pixabay
On this page 6 sections
Key takeaways
- When a parent reports fraud, the issuer can file a TC40 and a TC15. VAMP counts both, and a refund, a pre-dispute alert or a won case won't remove the TC40.
- Only Visa card-not-present sales count in the denominator, so your in-store volume doesn't water down your online disputes.
- Fraud reports that qualify for Compelling Evidence 3.0 are left out of the ratio, so save device, IP and order-history data on every online order.
- Your biggest lever is getting parents to contact you before they call the bank. Alerts help much less.
Vape shop chargebacks that start with "my kid used my card" are fraud claims. You win them with records created at the moment of sale: a third-party age verification result tied to the order and a 3-D Secure authentication on the card. You prevent them by making it faster for a parent to get a refund from you than from their bank. That second job matters more than it used to. Under Visa's current monitoring program, one parent's fraud claim can count against your store twice, and a later refund or a won dispute doesn't erase it.
Five Disputes Vape Sellers See, and the Proof Each Needs
The reason the cardholder gives decides which evidence the issuer looks at, so sort each dispute first.
| Dispute Type | What the Cardholder Claims | Evidence That Helps Most |
|---|---|---|
| Household member used the card | "I didn't make this purchase" | Age verification record, 3-D Secure result, earlier undisputed orders on the card |
| Unrecognized charge | "I don't know this merchant" | Descriptor matching your store name, confirmation email |
| Item not received | "My order never arrived" | Tracking, adult signature and ID check record |
| Not as described or defective | "The device leaked" | Product listing, return policy, support log |
| Canceled order | "I canceled and was still charged" | Cancellation terms shown at checkout, timestamps |
Online stores see far more of the first three. No card is present, and the box lands at a house where a parent and a teenager both collect the mail.
A household-member claim is filed as fraud. Sometimes the claim is true. Other times the parent bought the item, or allowed it, and regrets it once the statement arrives. Payments people call that friendly fraud. The issuer can't tell the two apart from the cardholder's call, so your records have to.
How Visa Counts Vape Shop Chargebacks in 2026
Visa merged its separate dispute and fraud programs into the Visa Acquirer Monitoring Program (VAMP). It took effect April 1, 2025, and enforcement began October 1, 2025. Visa's VAMP fact sheet defines a single ratio based on counts of card-not-present transactions. You add fraud reports (TC40s, which the issuer files when a cardholder calls a charge fraudulent) to disputes (TC15s, the chargebacks themselves) and divide by settled transactions.
Since April 1, 2026, Visa flags a U.S. merchant as Excessive at a 1.5% ratio with at least 1,500 counted events in a month. The line was 2.2% when enforcement began.
Few independent vape shops will log 1,500 events in a month, but the ratio still applies to you. Visa also measures your acquirer, the bank behind your merchant account. An acquirer's whole portfolio is rated Above Standard at 0.5% and Excessive at 0.7%. Acquirers with high-risk merchants protect those numbers by setting their own limits for each merchant, which can be stricter than Visa's, and they enforce them with reserves or account closure. A closed account can lead to a MATCH listing, which makes your next approval much harder. Ask your processor to tell you in writing what limit your merchant agreement sets.
Why a Teen's Purchase Counts Twice
When a parent tells the bank a charge was unauthorized, the issuer files a fraud report. If it also charges the sale back, that's a dispute too. VAMP counts both.
That breaks three common assumptions. A refund issued after the parent has called the bank stops the chargeback but leaves the fraud report in place. Pre-dispute alerts such as Visa's Rapid Dispute Resolution work the same way: they remove the dispute and leave the TC40. Winning the chargeback doesn't help the ratio either, because the monitoring programs ignore outcomes and refunds.
Your counter sales won't dilute the problem. Only Visa card-not-present sales count in the denominator, so a shop that rings up most of its volume at the register is judged on its web orders alone.
One exception works in your favor. Visa leaves out TC40s that qualify for Compelling Evidence 3.0. That Visa rule lets a merchant answer certain card-not-present fraud disputes with earlier, undisputed purchases by the same cardholder that share data such as device, IP address or shipping address. A teen who uses a parent's saved card on the family laptop and ships to the family home fits that pattern closely. Ask your processor and gateway which data fields an order needs to qualify.
Worked Example: One Online Store's Month
These numbers are illustrative. Assume a store settles 2,500 Visa card-not-present transactions in a month, plus 4,000 Visa sales at its counter. Eight parents tell their banks a teenager placed an order, and each issuer files a fraud report and a chargeback. Four other customers file item-not-received chargebacks, which create a dispute but no fraud report.
| Scenario | TC40s | TC15s | VAMP-Style Ratio |
|---|---|---|---|
| Baseline month | 8 | 12 | 20 ÷ 2,500 = 0.80% |
| 3 fraud cases refunded through alerts | 8 | 9 | 17 ÷ 2,500 = 0.68% |
| 5 of the 8 parents contact the store first | 3 | 7 | 10 ÷ 2,500 = 0.40% |
If the owner divided the 12 chargebacks by all 6,500 Visa sales, they'd get 0.18%, less than a quarter of Visa's figure. The table also shows where the real leverage is. Alerts only trimmed the ratio. Parents who called the store before the bank cut it in half, because a refund issued before any fraud report leaves nothing to count.
Refund, Fight or Accept: Decide Before You Respond
Start every household-member dispute with an honest question: did a minor get product from you? If your age check failed, refund or accept the chargeback and fix the gap. Regulators and your processor care far more about how often minors get through than about one case you won.
Fight when your controls worked and the file proves it. A third-party age verification pass, a successful 3-D Secure authentication and an adult-signature delivery record show that a verified adult's identity and card were used. Handle orders that also qualify for Compelling Evidence 3.0 first. Fighting those gets the money back and takes the fraud report out of your ratio.
Accept when the evidence is thin, such as a checkbox age gate with no authentication behind it. Once the fraud report exists, losing the dispute and accepting it affect your ratio the same way. So the decision comes down to the dollar amount and your staff's time.
Build the Evidence File at the Moment of Sale
Capture Verification and Device Data Online
Age verification that checks name, date of birth and address against third-party data gives you a timestamped result. That's far harder to dispute than an "I am of legal age" checkbox. Our guide to online age verification for vape stores covers what underwriters expect.
Pair it with 3-D Secure, which checks the cardholder's identity with their bank at checkout. It can shift liability for certain fraud disputes to the issuer, so ask your processor which disputes that covers. Our article on how 3D Secure shifts liability without costing you sales has more. Also save device and IP data along with the customer's undisputed order history. That's what a Compelling Evidence 3.0 response is built from.
Tie the ID Check to the Sale at the Counter
Your best in-store evidence is the chip or tap record plus a POS log showing the age check for that sale. A POS that prompts for ID on restricted SKUs timestamps the check against the transaction. Our review of the best vape shop POS for age checks explains what to look for. Keep camera footage long enough to cover the dispute window your processor advises.
Keep age verification and name matching as separate rules. Confirming legal age is a legal obligation. Requiring the name on the ID to match the card is only a store policy. Card network rules limit when merchants can demand ID as a condition of accepting a card, so check with your processor before you make it mandatory.
Prove Delivery to a Verified Adult
Against "my package never arrived," your strongest record is adult-signature delivery with an ID check, because it shows the box went to a verified adult. Federal and state rules also decide which carriers you can use for vapor products. Our guide to shipping vapes under the PACT Act walks through them. Confirm your current obligations with a qualified compliance professional.
Give Parents a Faster Route Than the Bank
Start with the billing descriptor, the business name on the cardholder's statement. Vape sellers who ship in plain packaging sometimes want an equally discreet name on the statement. But a parent who sees a name they don't recognize calls the bank and reports fraud, which turns a legitimate sale into a TC40. Match the descriptor to the store name shown at checkout and add a phone number or website where your processor allows it. Then put a line in the confirmation email: "This charge will appear on your statement as [your descriptor]."
A descriptor must accurately represent your business. Using a vague or unrelated name to hide that you sell vape products can be treated as misrepresentation or transaction laundering and can end your merchant account. Discreet packaging is fine; a misleading descriptor is not. If yours doesn't match your storefront, ask your processor to change it.
Next, write a refund policy that addresses purchases by household members directly. Tell cardholders how to report an order they didn't authorize. Consider refunding verified cases without requiring a return, since opened nicotine products generally can't be resold. Cover defective hardware and lost shipments as well, and set a cancellation cutoff such as "before the order ships." Show the policy at checkout with a required acknowledgment, and repeat it in the confirmation email and at the register.
Then answer fast. If a parent can find your support contact in one step and gets a reply the same day, you catch the complaint before it reaches the bank. Log each teen-purchase case, since a cluster of them points to a weak spot in your age checks. Some online vape stores also add ACH and eCheck as a backup payment method, though ACH has its own return rules and isn't dispute-free.
Run Your Own VAMP Number This Week
Pull three months of disputes and fraud reports from your processor's portal and count them Visa's way: fraud reports plus disputes, divided by Visa card-not-present sales only. Then mark which household-member claims reached you before the bank. That split tells you whether to spend first on stronger age checks or on getting parents to call you. On the same call, ask your processor what dispute limit your contract sets.
MannyPay offers vape and e-cig merchant accounts through its high-risk payment processing. It also offers 3-D Secure authentication for online payments, plus POS systems and terminals for in-store sales. Approval depends on underwriting. To review your setup, request a free quote, and a MannyPay specialist will respond within one business day.
This article is general information, not legal or compliance advice. Vape laws vary by state and change often, so confirm your obligations with a qualified professional.
Sources
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
